If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Aug 8, 2025 | Jul 16, 2025 |
| Amazon_linux_2023 | — | Upgrade bind-docUpgrade bind-utilsUpgrade bind-libsUpgrade bind-debuginfoUpgrade bind-chrootUpgrade bind-utils-debuginfoUpgrade bind-dnssec-utilsUpgrade bindUpgrade bind-dnssec-utils-debuginfoUpgrade bind-licenseUpgrade bind-libs-debuginfoUpgrade bind-debugsourceUpgrade bind-devel | Jul 30, 2025 | Jul 16, 2025 |
| Debian | — | Upgrade bind9 | Jul 18, 2025 | Jul 16, 2025 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Feb 20, 2026 | Feb 20, 2026 |
| Suse | — | Upgrade bind-modules-sqlite3Upgrade bind-modules-perlUpgrade bind-modules-mysqlUpgrade bindUpgrade bind-docUpgrade bind-modules-genericUpgrade bind-utilsUpgrade bind-modules-ldap | Dec 5, 2025 | Jul 17, 2025 |
| Ubuntu | — | Upgrade bind9 | Jul 17, 2025 | Jul 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Jul 16, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub